Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\RarSFX0\activation.exe'
- '%TEMP%\RarSFX0\hid.exe' install.cmd
Запускает на исполнение:
- '<SYSTEM32>\schtasks.exe' /Create /TN "KMS Aktivasyon " /TR "%WINDIR%\KMS.exe" /SC DAILY /RU SYSTEM /RL Highest /F
- '<SYSTEM32>\schtasks.exe' /Create /TN "KMS Aktivasyon" /TR "%WINDIR%\KMS.exe" /SC ONSTART /RU SYSTEM /RL Highest /F
- '<SYSTEM32>\cmd.exe' /c install.cmd
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\KMS.exe
- <SYSTEM32>\Tasks\KMS Aktivasyon
- <SYSTEM32>\Tasks\KMS Aktivasyon
- %TEMP%\RarSFX0\install.cmd
- %TEMP%\RarSFX0\activation.exe
- %TEMP%\RarSFX0\hid.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\RarSFX0\hid.exe
- %TEMP%\RarSFX0\install.cmd
Удаляет следующие файлы:
- %WINDIR%\Prefetch\SVCHOST.EXE-007FEA55.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-05F624AB.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-7AC6742A.pf
- %WINDIR%\Prefetch\SLUI.EXE-724E99D9.pf
- %WINDIR%\Prefetch\SMSS.EXE-E9C28FC6.pf
- %WINDIR%\Prefetch\SPPSVC.EXE-B0F8131B.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-7CFEDEA3.pf
- %WINDIR%\Prefetch\TASKENG.EXE-48D4E289.pf
- %WINDIR%\Prefetch\TASKHOST.EXE-7238F31D.pf
- %WINDIR%\Prefetch\TASKMGR.EXE-5F5F473D.pf
- %WINDIR%\Prefetch\SVCHOST.EXE-80F4A784.pf
- %WINDIR%\Prefetch\SYSTEMPROPERTIESADVANCED.EXE-68C7C4F0.pf
- %WINDIR%\Prefetch\SYSTEMPROPERTIESPROTECTION.EX-64B3993D.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-DE9673F9.pf
- %WINDIR%\Prefetch\SC.EXE-945D79AE.pf
- %WINDIR%\Prefetch\SDIAGNHOST.EXE-8D72177C.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-230FC512.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-66E27D9E.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-A1C4127F.pf
- %WINDIR%\Prefetch\SEARCHFILTERHOST.EXE-77482212.pf
- %WINDIR%\Prefetch\SETUP_WM.EXE-674F654A.pf
- %WINDIR%\Prefetch\SIDEBAR.EXE-FA75EA61.pf
- %WINDIR%\Prefetch\SLEEP.EXE-84B9463D.pf
- %WINDIR%\Prefetch\SEARCHINDEXER.EXE-4A6353B9.pf
- %WINDIR%\Prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf
- %WINDIR%\Prefetch\SERVICES.EXE-511D36F4.pf
- %WINDIR%\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf
- %WINDIR%\Prefetch\WMPLAYER.EXE-BAD6BD53.pf
- %WINDIR%\Prefetch\WMPSHARE.EXE-90B956F1.pf
- %WINDIR%\Prefetch\WUSETUPV.EXE-C61614F3.pf
- %WINDIR%\Prefetch\WLRMDR.EXE-C2B47318.pf
- %WINDIR%\Prefetch\WMIADAP.EXE-F8DFDFA2.pf
- %WINDIR%\Prefetch\WMIPRVSE.EXE-1628051C.pf
- %WINDIR%\Prefetch\ReadyBoot\Trace1.fx
- %WINDIR%\Prefetch\ReadyBoot\Trace9.fx
- %TEMP%\RarSFX0\hid.exe
- %TEMP%\RarSFX0\install.cmd
- %WINDIR%\Prefetch\ReadyBoot\Trace10.fx
- %WINDIR%\Prefetch\ReadyBoot\Trace7.fx
- %WINDIR%\Prefetch\ReadyBoot\Trace8.fx
- %WINDIR%\Prefetch\USERINIT.EXE-2257A3E7.pf
- %WINDIR%\Prefetch\VCREDIST_X86_2005SP1.EXE-BFD460CB.pf
- %WINDIR%\Prefetch\VCREDIST_X86_2008.EXE-91DF5AEE.pf
- %WINDIR%\Prefetch\UNLODCTR.EXE-531FACC7.pf
- %WINDIR%\Prefetch\UNREGMP2.EXE-2294B148.pf
- %WINDIR%\Prefetch\UPDATE.EXE-11DF892E.pf
- %WINDIR%\Prefetch\VCREDIST_X86_2010.EXE-5CA3F803.pf
- %WINDIR%\Prefetch\WERMGR.EXE-0F2AC88C.pf
- %WINDIR%\Prefetch\WININIT.EXE-5322684A.pf
- %WINDIR%\Prefetch\WINLOGON.EXE-B020DC41.pf
- %WINDIR%\Prefetch\VERCLSID.EXE-7C52E31C.pf
- %WINDIR%\Prefetch\VSSVC.EXE-B8AFC319.pf
- %WINDIR%\Prefetch\W7LXE.EXE-427DDCFF.pf
- %WINDIR%\Prefetch\CSRSS.EXE-3FE41F7E.pf
- %WINDIR%\Prefetch\CVTRES.EXE-069169FB.pf
- %WINDIR%\Prefetch\DEFRAG.EXE-588F90AD.pf
- %WINDIR%\Prefetch\CONSENT.EXE-531BD9EA.pf
- %WINDIR%\Prefetch\CONTROL.EXE-817F8F1D.pf
- %WINDIR%\Prefetch\CSC.EXE-A3B8D95D.pf
- %WINDIR%\Prefetch\DFRGUI.EXE-C853DD35.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-74857ABA.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-766398D2.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-79E9E64A.pf
- %WINDIR%\Prefetch\DISM.EXE-DE199F71.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-040BC33A.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-5E46FA0D.pf
- %WINDIR%\Prefetch\AgGlFgAppHistory.db
- %WINDIR%\Prefetch\AgGlGlobalHistory.db
- %WINDIR%\Prefetch\AgGlUAD_P_S-1-5-21-3525224950-2885160813-905547259-1000.db
- %TEMP%\RarSFX0\activation.exe
- %WINDIR%\Prefetch\AgAppLaunch.db
- %WINDIR%\Prefetch\AgGlFaultHistory.db
- %WINDIR%\Prefetch\AgGlUAD_S-1-5-21-3525224950-2885160813-905547259-1000.db
- %WINDIR%\Prefetch\CMD.EXE-4A81B364.pf
- %WINDIR%\Prefetch\COMPMGMTLAUNCHER.EXE-D8C6028E.pf
- %WINDIR%\Prefetch\CONHOST.EXE-1F3E9D7E.pf
- %WINDIR%\Prefetch\AgRobust.db
- %WINDIR%\Prefetch\CHKDSK.EXE-7F65C258.pf
- %WINDIR%\Prefetch\CLEANMGR.EXE-E3C5E89D.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-D22EEB48.pf
- %WINDIR%\Prefetch\MPCMDRUN.EXE-F401FBB4.pf
- %WINDIR%\Prefetch\MPSIGSTUB.EXE-9EF565C7.pf
- %WINDIR%\Prefetch\MSASCUI.EXE-07E0123F.pf
- %WINDIR%\Prefetch\MMC.EXE-F5DC4F82.pf
- %WINDIR%\Prefetch\MOBSYNC.EXE-C5E2284F.pf
- %WINDIR%\Prefetch\MPAM-9040200A.EXE-0516E020.pf
- %WINDIR%\Prefetch\MSCONFIG.EXE-3A52734E.pf
- %WINDIR%\Prefetch\NTOSBOOT-B00DFAAD.pf
- %WINDIR%\Prefetch\PfSvPerfStats.bin
- %WINDIR%\Prefetch\REGEDIT.EXE-90FEEA06.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-C3C515BD.pf
- %WINDIR%\Prefetch\NET.EXE-DF44F913.pf
- %WINDIR%\Prefetch\NOTEPAD.EXE-D8414F97.pf
- %WINDIR%\Prefetch\FAR.EXE-C88E1387.pf
- %WINDIR%\Prefetch\IEXPLORE.EXE-908C99F8.pf
- %WINDIR%\Prefetch\IPCONFIG.EXE-912F3D5B.pf
- %WINDIR%\Prefetch\DLLHOST.EXE-F2DCEF0D.pf
- %WINDIR%\Prefetch\DRVINST.EXE-4CB4314A.pf
- %WINDIR%\Prefetch\EXPLORER.EXE-A80E4F97.pf
- %WINDIR%\Prefetch\KMSEMUL.EXE-01255DD6.pf
- %WINDIR%\Prefetch\MMC.EXE-53159585.pf
- %WINDIR%\Prefetch\MMC.EXE-561C5A40.pf
- %WINDIR%\Prefetch\MMC.EXE-E5EE3A89.pf
- %WINDIR%\Prefetch\Layout.ini
- %WINDIR%\Prefetch\LOGONUI.EXE-09140401.pf
- %WINDIR%\Prefetch\LSASS.EXE-419F2D06.pf
Другое:
Ищет следующие окна:
- ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
